@go-to-k/cdkd 0.283.7 → 0.283.9

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as configStringRefusal, $t as resolveSkipPrefix, A as green, At as rewriteTemplateAssetReferences, B as slowCcOperationTimeoutMs, Bt as formatDockerLoginError, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as CdkdError, Ct as shouldRetainResource, D as bold, Dn as LocalInvokeBuildError$1, Dt as buildAssetRedirectMap, E as formatResourceLine, En as DeployCancelledError, Et as WorkGraph, F as clearOnUpdateRemoval, Fn as ResourceTimeoutError, Ft as parseBootstrapMarker, G as getAccountInfo, Gt as getDockerImageBySourceHash, H as isTerminationProtectionPropagationError, Ht as runDockerForeground, I as ProviderRegistry, In as ResourceUpdateNotSupportedError, It as validateAssetBucketName, J as normalizeAwsTagsToCfn, Jt as getDefaultStateBucketName, K as refStateLookupFromResource, Kt as Synthesizer, L as findActionableSilentDrops, Ln as StackHasActiveImportsError, Lt as validateContainerRepoName, M as yellow, Mn as NestedStackChildDirectDestroyError, Mt as BOOTSTRAP_MARKER_PREFIX, N as IAMRoleProvider, Nn as PartialFailureError, Nt as ensureAssetStorage, O as cyan, On as LocalMigrateError, Ot as createAssetRedirectResolver, P as collectInlinePolicyNamesManagedBySiblings, Pn as ProvisioningError, Pt as getBootstrapMarkerKey, Q as configBooleanRefusal, Qt as resolveCaptureObservedState, R as findSilentDropProperties, Rn as StackTerminationProtectionError, Rt as buildDenyExternalAccessPolicy, S as extractDeploymentEventError, St as rebuildClientForBucketRegion, T as renderStatefulReason, Tt as stringifyValue, U as IntrinsicFunctionResolver, Un as normalizeAwsError, Ut as runDockerStreaming, V as disableInstanceApiTermination, Vt as getDockerCmd, W as cfnRefValueFromPhysicalId, Wn as withErrorHandling, Wt as AssetManifestLoader, X as assertRegionMatch, Xt as resolveApp, Y as resolveExplicitPhysicalId, Yt as getLegacyStateBucketName, Z as coerceCfnBoolean, Zt as resolveAutoAssetStorage, _ as createPreDeleteFinalSnapshot, _n as resolveBucketRegion, _t as markNonRetryable, a as DeploymentEventsStore, an as CFN_TEMPLATE_BODY_LIMIT, at as s3BucketArn, b as unsupportedFinalSnapshotError, bn as resetAwsClients, bt as LockManager, c as replayFailedOperations, cn as findLargeInlineResources, ct as s3BucketRegionalDomainName, d as IMPLICIT_DELETE_DEPENDENCIES, dn as PARTITION_TABLE, dt as DiffCalculator, en as resolveStateBucketWithDefault, et as readConfigString, f as computeImplicitDeleteEdges, fn as canonicalizeRegion, ft as describeTypeWithThrottleRetry, g as ccRoutedFinalSnapshotError, gt as isThrottlingError, h as buildFinalSnapshotIdentifier, hn as processStackMessages, ht as isRetryableTransientError, i as DeploymentEventsReader, in as warnDeprecatedNoPrefixCliFlag, it as requireConfigString, j as red, jn as MissingCdkCliError, jt as AssetModeResolver, k as gray, kn as LocalStartServiceError, kt as loadPublishableAssetManifest, l as replayRollback, ln as uploadCfnTemplate, lt as s3BucketWebsiteUrl, m as PRE_DELETE_SNAPSHOT_TYPES, mn as AssemblyReader, mt as isMarkedNonRetryable, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resolveUseCdkBootstrapAssets, nt as requireConfigArray, o as planFailedOps, on as CFN_TEMPLATE_URL_LIMIT, ot as s3BucketDomainName, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as derivePartitionAndUrlSuffix, pt as withRetry, q as WAFv2WebACLProvider, qt as synthesisStatusMessage, r as DeployEngine, rn as stateBucketExistenceConfirmed, rt as requireConfigObject, s as planRollback, sn as MIGRATE_TMP_PREFIX, st as s3BucketDualStackDomainName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveStateBucketWithDefaultAndSource, tt as replayWarn, u as withResourceDeadline, un as expectedOwnerParam, ut as applyRoleArnIfSet, v as isFinalSnapshotError, vn as AwsClients, vt as DagBuilder, w as isStatefulRecreateTargetSync, wt as AssetPublisher, x as makeCanonicalizePropertiesFn, xn as setAwsClients, xt as S3StateBackend, y as refusesFinalSnapshot, yn as getAwsClients, yt as TemplateParser, z as CloudControlProvider, zt as buildDockerImage } from "./deploy-engine-CKpBSlde.js";
+import { $ as coerceCfnBoolean, $t as resolveStateBucketWithDefaultAndSource, A as cyan, An as NestedStackChildDirectDestroyError, At as BOOTSTRAP_MARKER_PREFIX, B as findSilentDropProperties, Bt as runDockerForeground, C as makeCanonicalizePropertiesFn, Ct as stringifyValue, D as renderStatefulReason, Dn as LocalStartServiceError, Dt as loadPublishableAssetManifest, E as isStatefulRecreateTargetSync, En as LocalMigrateError, Et as createAssetRedirectResolver, F as IAMRoleProvider, Fn as StackHasActiveImportsError, Ft as validateContainerRepoName, G as IntrinsicFunctionResolver, Gn as isThrottlingError, Gt as synthesisStatusMessage, H as slowCcOperationTimeoutMs, Hn as withErrorHandling, Ht as AssetManifestLoader, I as collectInlinePolicyNamesManagedBySiblings, In as StackTerminationProtectionError, It as buildDenyExternalAccessPolicy, J as refStateLookupFromResource, Jt as resolveApp, K as cfnRefValueFromPhysicalId, Kn as markNonRetryable, Kt as getDefaultStateBucketName, L as clearOnUpdateRemoval, Lt as buildDockerImage, M as green, Mn as ProvisioningError, Mt as getBootstrapMarkerKey, N as red, Nn as ResourceTimeoutError, Nt as parseBootstrapMarker, O as formatResourceLine, Ot as rewriteTemplateAssetReferences, P as yellow, Pn as ResourceUpdateNotSupportedError, Pt as validateAssetBucketName, Q as assertRegionMatch, Qt as resolveStateBucketWithDefault, R as ProviderRegistry, Rt as formatDockerLoginError, S as unsupportedFinalSnapshotError, St as AssetPublisher, T as MULTI_REGION_RECREATE_BLOCKED_TYPES, Tn as LocalInvokeBuildError$1, Tt as buildAssetRedirectMap, U as disableInstanceApiTermination, Un as isMarkedNonRetryable, Ut as getDockerImageBySourceHash, V as CloudControlProvider, Vn as normalizeAwsError, Vt as runDockerStreaming, W as isTerminationProtectionPropagationError, Wn as isRetryableTransientError, Wt as Synthesizer, X as normalizeAwsTagsToCfn, Xt as resolveCaptureObservedState, Y as WAFv2WebACLProvider, Yt as resolveAutoAssetStorage, Z as resolveExplicitPhysicalId, Zt as resolveSkipPrefix, _ as buildFinalSnapshotIdentifier, _n as getAwsClients, _t as TemplateParser, a as DeploymentEventsStore, an as MIGRATE_TMP_PREFIX, at as requireConfigObject, b as isFinalSnapshotError, bt as rebuildClientForBucketRegion, c as replayFailedOperations, cn as expectedOwnerParam, ct as s3BucketDomainName, d as deleteSkipReason, dn as derivePartitionAndUrlSuffix, dt as s3BucketWebsiteUrl, en as resolveUseCdkBootstrapAssets, et as configBooleanRefusal, f as withResourceDeadline, fn as AssemblyReader, ft as applyRoleArnIfSet, g as PRE_DELETE_SNAPSHOT_TYPES, gn as AwsClients, gt as DagBuilder, h as ATOMIC_FINAL_SNAPSHOT_TYPES, hn as resolveBucketRegion, ht as withRetry, i as DeploymentEventsReader, in as CFN_TEMPLATE_URL_LIMIT, it as requireConfigArray, j as gray, jn as PartialFailureError, jt as ensureAssetStorage, k as bold, kn as MissingCdkCliError, kt as AssetModeResolver, l as replayRollback, ln as PARTITION_TABLE, lt as s3BucketDualStackDomainName, m as computeImplicitDeleteEdges, mt as describeTypeWithThrottleRetry, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as warnDeprecatedNoPrefixCliFlag, nt as readConfigString, o as planFailedOps, on as findLargeInlineResources, ot as requireConfigString, p as IMPLICIT_DELETE_DEPENDENCIES, pn as processStackMessages, pt as DiffCalculator, q as getAccountInfo, qt as getLegacyStateBucketName, r as DeployEngine, rn as CFN_TEMPLATE_BODY_LIMIT, rt as replayWarn, s as planRollback, sn as uploadCfnTemplate, st as s3BucketArn, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as stateBucketExistenceConfirmed, tt as configStringRefusal, u as UNSPECIFIED_SKIP_REASON, un as canonicalizeRegion, ut as s3BucketRegionalDomainName, v as ccRoutedFinalSnapshotError, vn as resetAwsClients, vt as LockManager, w as extractDeploymentEventError, wn as DeployCancelledError, wt as WorkGraph, x as refusesFinalSnapshot, xn as CdkdError, xt as shouldRetainResource, y as createPreDeleteFinalSnapshot, yn as setAwsClients, yt as S3StateBackend, z as findActionableSilentDrops, zt as getDockerCmd } from "./deploy-engine-CWt7h7Nc.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-o7QsopaI.js";
+import { t as ASGProvider } from "./asg-provider-D5ZBSgh2.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -2649,7 +2649,7 @@ const POLICY_NO_TARGET_SKIP_REASON = "no Roles/Groups/Users in state — no dele
 * removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
 * carries for the composite-id family.
 */
-const DEPLOY_SKIP_CAVEAT$3 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+const DEPLOY_SKIP_CAVEAT$3 = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, remove the resource by hand.";
 /**
 * AWS IAM Policy Provider
 *
@@ -3966,7 +3966,7 @@ const MEMBERSHIP_MISSING_FIELDS_SKIP_REASON = "GroupName/Users missing from stat
 * be removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
 * carries for the composite-id family.
 */
-const DEPLOY_SKIP_CAVEAT$2 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the memberships by hand.";
+const DEPLOY_SKIP_CAVEAT$2 = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, remove the memberships by hand.";
 /**
 * AWS IAM User / Group / UserToGroupAddition Provider
 *
@@ -11857,7 +11857,7 @@ const PERMISSION_STATEMENT_ID_SKIP_REASON = "empty StatementId in state physical
 * carries for the composite-id family; a remedy that is impossible on the path
 * the user is actually on is worse than no remedy.
 */
-const DEPLOY_SKIP_CAVEAT$1 = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+const DEPLOY_SKIP_CAVEAT$1 = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, remove the resource by hand.";
 /**
 * AWS Lambda Permission Provider
 *
@@ -12834,14 +12834,14 @@ const LAYER_VERSION_SKIP_REASON = "unparsable version in state LayerVersionArn
 * The deploy-side caveat both skip warnings in this file carry (issue
 * [#1762](https://github.com/go-to-k/cdkd/issues/1762)).
 *
-* "Repair state.json and re-run" is only true on DESTROY, where the skip KEEPS
-* the record. The same arms are ALSO reached from `deploy-engine.ts` and
-* `rollback-executor.ts`, which discard the delete result and DROP the record —
-* there the id is gone, so re-running cannot help and the resource has to be
-* removed by hand. Mirrors the caveat `compositeIdFormatMessage` already
-* carries for the composite-id family.
+* "Repair state.json and re-run" holds on DESTROY and, since #1762, on the
+* deploy engine's template-removal DELETE — both keep the record. It does NOT
+* hold for a deploy-side REPLACEMENT or rollback delete: those now FAIL the
+* resource rather than reporting success, and the old resource can be left
+* untracked, so it has to be removed by hand. Mirrors the caveat
+* `compositeIdFormatMessage` carries for the composite-id family.
 */
-const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy (the DELETE of a resource removed from the template, plus the replacement / rollback deletes), which DROP the state record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, remove the resource by hand.";
+const DEPLOY_SKIP_CAVEAT = "NOTE this arm is ALSO reached from cdkd deploy. Since issue 1762 the DELETE of a resource removed from the template behaves like destroy — the record is KEPT and the next deploy re-attempts it — but a REPLACEMENT / rollback delete FAILS the resource instead (https://github.com/go-to-k/cdkd/issues/1762), leaving the old one untracked; there, remove the resource by hand.";
 /**
 * AWS Lambda LayerVersion Provider
 *
@@ -13194,19 +13194,20 @@ function formatShape(segments) {
 * prints a `⚠ … skipped` line instead of `✓ … deleted`, reports
 * `N deleted, 1 skipped`, KEEPS the state record, and exits non-zero. The
 * wording here changed accordingly — it used to promise unconditionally that
-* cdkd "will report this delete as successful", which is no longer true on the
-* destroy path. It is STILL true for the deploy engine's replacement / rollback
-* deletes, which discard the return value (issue
-* [#1762](https://github.com/go-to-k/cdkd/issues/1762)), so the message names
-* both callers rather than describing only the fixed one — a remedy of
-* "drop the record with 'cdkd state orphan'" is impossible on a path that has
-* already dropped it.
+* cdkd "will report this delete as successful", which is no longer true on
+* either path. Issue [#1762](https://github.com/go-to-k/cdkd/issues/1762) then
+* taught the deploy engine to consume the outcome too, so the message no longer
+* warns that deploy drops the record: the template-removal DELETE keeps it,
+* exactly like destroy. What it DOES still distinguish is the replacement /
+* rollback delete, which fails the resource and can leave the old one
+* untracked — there "drop the record with 'cdkd state orphan'" is not the
+* remedy, deleting the resource by hand is.
 */
 function compositeIdFormatMessage(format, logicalId, physicalId, options) {
 	const accepted = format.alsoAccepts ? `"${formatShape(format.segments)}" or ${format.alsoAccepts}` : `"${formatShape(format.segments)}"`;
 	const head = `Invalid physicalId format for ${format.label} ${logicalId}: expected ${accepted}, got "${physicalId}"`;
 	if (!options?.skipping) return head;
-	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. On 'cdkd destroy' / 'cdkd state destroy' the state record is KEPT and the run exits non-zero, so repair the id in state.json and re-run (or delete the resource by hand and drop the record with 'cdkd state orphan'). NOTE this arm is ALSO reached from cdkd deploy — the plain DELETE of a resource removed from the template (the most common one), plus the replacement and rollback deletes — all of which still DROP the record and report success (https://github.com/go-to-k/cdkd/issues/1762) — there, delete it by hand.`;
+	return `${head}. Skipping the delete — no AWS call is issued, so the resource is LEFT IN PLACE. The state record is KEPT and the run reports the skip: on 'cdkd destroy' / 'cdkd state destroy' (which exits non-zero) and, since issue 1762, on the plain DELETE of a resource removed from the template during cdkd deploy (which re-attempts it on the next deploy). So repair the id in state.json and re-run, or delete the resource by hand and drop the record with 'cdkd state orphan'. NOTE a deploy-side REPLACEMENT or rollback delete instead FAILS the resource (https://github.com/go-to-k/cdkd/issues/1762) — the old resource is left untracked there, so delete it by hand.`;
 }
 /**
 * The short `ResourceDeleteResult.reason` every malformed-composite-id DELETE
@@ -15181,6 +15182,23 @@ var DynamoDBTableProvider = class {
 //#endregion
 //#region src/provisioning/providers/dynamodb-globaltable-provider.ts
 /**
+* The CLOSED path table {@link DynamoDBGlobalTableProvider.canonicalizeDriftProperties}
+* strips from BOTH drift comparison sides (issue #1742).
+*
+* One entry today: the AWS-computed `GlobalSecondaryIndexes[].WarmThroughput`.
+* A table rather than an inline check so a second per-array-element member
+* lands as a row instead of a second walk — and so the scope is READABLE as a
+* list of paths, which is what "closed table" means here. Deliberately does
+* NOT include `LocalSecondaryIndexes` (this provider's readback assigns the
+* raw SDK descriptions there, a wider divergence than one member) or
+* `Replicas[].GlobalSecondaryIndexes` (whose entries carry only the read-half
+* throughput blocks — no `WarmThroughput` is emitted or accepted there).
+*/
+const DRIFT_STRIPPED_INDEX_MEMBERS = [{
+	listKey: "GlobalSecondaryIndexes",
+	member: "WarmThroughput"
+}];
+/**
 * AWS DynamoDB GlobalTable Provider
 *
 * Implements resource provisioning for AWS::DynamoDB::GlobalTable using the
@@ -16634,7 +16652,12 @@ var DynamoDBGlobalTableProvider = class {
 					const entry = { IndexName: gsi.IndexName };
 					if (gsi.KeySchema) entry["KeySchema"] = gsi.KeySchema;
 					if (gsi.Projection) entry["Projection"] = gsi.Projection;
-					if (gsi.WarmThroughput) entry["WarmThroughput"] = gsi.WarmThroughput;
+					if (gsi.WarmThroughput) {
+						const warm = {};
+						if (gsi.WarmThroughput.ReadUnitsPerSecond !== void 0) warm["ReadUnitsPerSecond"] = gsi.WarmThroughput.ReadUnitsPerSecond;
+						if (gsi.WarmThroughput.WriteUnitsPerSecond !== void 0) warm["WriteUnitsPerSecond"] = gsi.WarmThroughput.WriteUnitsPerSecond;
+						if (Object.keys(warm).length > 0) entry["WarmThroughput"] = warm;
+					}
 					const replicaEntry = { IndexName: gsi.IndexName };
 					if (billingMode === "PROVISIONED") {
 						const writeAutoScaling = await this.readAutoScalingSettings(tableNameForSubs, "dynamodb:index:WriteCapacityUnits", void 0, gsi.IndexName);
@@ -16887,6 +16910,115 @@ var DynamoDBGlobalTableProvider = class {
 		return ["AttributeDefinitions"];
 	}
 	/**
+	* Strip the AWS-computed per-index `WarmThroughput` from BOTH drift
+	* comparison sides (issue #1742 defect 2, on the #1784 seam).
+	*
+	* `DescribeTable` reports a `WarmThroughput` for EVERY index whether or not
+	* the template asked for one — a default `{ReadUnitsPerSecond: 12000,
+	* WriteUnitsPerSecond: 4000, Status: 'ACTIVE'}`, measured us-east-1
+	* 2026-08-13 on the `rollback-replay-effective-props` fixture — so on a
+	* `properties`-only baseline (what a reverse-replacement rollback leaves
+	* behind, since `rollback-executor.ts` strips `observedProperties`) the
+	* member is a permanent one-sided difference: `cdkd drift` reports the table
+	* forever and `--revert` re-issues calls for it.
+	*
+	* Why this mechanism and not the two cheaper ones:
+	*
+	* - `getDriftUnknownPaths` (the #1760 answer for the sibling type's
+	*   TOP-LEVEL member) cannot express it. `calculateResourceDrift` compares
+	*   arrays wholesale, so `isIgnoredPath` is never asked about a path that
+	*   crosses one; the only expressible suppression is the WHOLE
+	*   `GlobalSecondaryIndexes` subtree, i.e. never detecting an index add /
+	*   remove / capacity change again — the #1420 stopgap already refused.
+	* - Gating the READBACK emission on the desired side (this issue's own
+	*   second candidate answer) removes the phantom for the `properties`
+	*   baseline and CREATES one for the far larger `observedProperties`
+	*   population: every bag already in S3 was written by a binary that emitted
+	*   the computed member, so the first `cdkd drift` after upgrading compares
+	*   a baseline that HAS it against a readback that does not, and reports the
+	*   whole array on an untouched table. It does not self-heal — the observed
+	*   capture only runs on CREATE / UPDATE. That attempt was implemented,
+	*   reviewed and REVERTED; do not re-propose it.
+	*
+	* Stripping from BOTH sides is what converges the two populations at once: a
+	* stale observed record and a fresh readback both lose the member, and a
+	* `properties` baseline that never had it now faces an AWS side without it.
+	*
+	* ACCEPTED COST, stated because it is a real loss: a template that DECLARES
+	* a per-index `WarmThroughput` no longer has changes to it REPORTED by
+	* `cdkd drift`. The value is still SENT (`toSdkGlobalSecondaryIndexes`
+	* forwards it on create and on a new index), so this is a detection gap, not
+	* a delivery one, and it is bounded by what cdkd could do about a difference
+	* anyway: warm throughput only ever GROWS on the AWS side and cannot be
+	* lowered, so `--revert` would issue a decrease AWS rejects — the residual
+	* issue #1768 records for the sibling type's declared arm. A per-index
+	* declared-gate is not expressible here in any case: this hook sees ONE bag
+	* with no `side` argument and no reference to the desired side, which is the
+	* symmetry the #1784 contract requires and the reason one-sided
+	* normalization is refused.
+	*
+	* Scope is a CLOSED table rather than a walk for any key named
+	* `WarmThroughput`: `Replicas[].GlobalSecondaryIndexes[]` entries carry only
+	* the read-half throughput blocks (no `WarmThroughput` is emitted or
+	* accepted there), and a blanket strip would remove a member from a path
+	* nobody measured. The table is a FLAT list of `{listKey, member}` pairs —
+	* the type is hardcoded one line below, not a key of it — and nothing
+	* mechanically fences it against `readCurrentState`: a future per-replica
+	* `WarmThroughput` emission would desync silently, so a member added to the
+	* readback needs a row added here in the same change.
+	*
+	* The `resourceType` guard is kept but is UNREACHABLE, and the earlier
+	* claim that it followed the #1784 CC-API-fallback caveat was WRONG — that
+	* caveat is about the BAG SHAPE when a type has no `readCurrentState`, and
+	* never produces a foreign `resourceType`. `drift.ts` resolves the provider
+	* by `(resourceType, provisionedBy)` and then passes that SAME type back in,
+	* and this provider is registered for exactly one type, so the `!==` arm
+	* cannot fire. It stays as a cheap shape guard for a future second
+	* registration, not because anything routes a foreign type here.
+	*
+	* UNCOVERED POPULATION, stated because the fix does NOT reach it: a
+	* cc-api-routed GlobalTable gets neither half. Top-level `WarmThroughput` is
+	* a `silentDrop` property for this type, so a template declaring it
+	* auto-routes the whole resource through Cloud Control (the #614 routing)
+	* and the route is STICKY — `drift.ts` then resolves `provider` to
+	* `CloudControlProvider`, this hook is never invoked, and the AWS side comes
+	* from CC's `GetResource`. So the `properties`-only-baseline phantom drift
+	* this closes survives there. Pre-existing, not introduced here.
+	*
+	* Note the trigger is the TOP-LEVEL `WarmThroughput`, NOT the per-index
+	* member this strips: a template declaring only the per-index member keeps
+	* `GlobalSecondaryIndexes` (a handled property), stays SDK-routed, and IS
+	* covered. Do not read this bound as "warm-throughput templates are
+	* uncovered" — an earlier draft of this comment said so and was wrong.
+	*
+	* Pure, non-mutating, and identity-returning when nothing applies: the input
+	* bag is the caller's state record / readback, an unaffected table pays
+	* nothing, and only the index entries that actually carry the member are
+	* rebuilt.
+	*/
+	canonicalizeDriftProperties(resourceType, properties) {
+		if (resourceType !== "AWS::DynamoDB::GlobalTable") return properties;
+		let result = properties;
+		for (const { listKey, member } of DRIFT_STRIPPED_INDEX_MEMBERS) {
+			const list = result[listKey];
+			if (!Array.isArray(list)) continue;
+			let stripped = false;
+			const canonical = list.map((element) => {
+				const entry = asRecord$1(element);
+				if (!entry || !(member in entry)) return element;
+				stripped = true;
+				const copy = { ...entry };
+				delete copy[member];
+				return copy;
+			});
+			if (stripped) result = {
+				...result,
+				[listKey]: canonical
+			};
+		}
+		return result;
+	}
+	/**
 	* Adopt an existing DynamoDB GlobalTable into cdkd state.
 	*
 	* Lookup order:
@@ -53907,7 +54039,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 					});
 					renderer.removeTask(logicalId);
 					if (deleteResult?.outcome === "skipped") {
-						logger.info(`  ${formatResourceLine("skipped", logicalId, resource.resourceType, `skipped (${deleteResult.reason})`)}`);
+						const skipReason = deleteSkipReason(deleteResult) ?? "no reason reported by the provider";
+						logger.info(`  ${formatResourceLine("skipped", logicalId, resource.resourceType, `skipped (${skipReason})`)}`);
 						result.skippedCount++;
 						skippedStateTargets.add(stateTargetFor(logicalId, resource.resourceType));
 						ctx.eventRecorder?.record({
@@ -53918,7 +54051,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 							resourceType: resource.resourceType,
 							...resource.provisionedBy && { provisionedBy: resource.provisionedBy },
 							...resource.physicalId && { physicalId: resource.physicalId },
-							reason: deleteResult.reason,
+							reason: skipReason,
 							durationMs: Date.now() - resourceStartedAt
 						});
 						return;
@@ -55458,6 +55591,7 @@ async function deployCommand(stacks, options) {
 				logger.info(`  Created: ${deployResult.created > 0 ? green(deployResult.created) : gray(deployResult.created)}`);
 				logger.info(`  Updated: ${deployResult.updated > 0 ? yellow(deployResult.updated) : gray(deployResult.updated)}`);
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
+				if (deployResult.deleteSkipped > 0) logger.info(`  Skipped (not deleted): ${yellow(deployResult.deleteSkipped)}`);
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
 				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
@@ -55470,7 +55604,8 @@ async function deployCommand(stacks, options) {
 				recordRunSucceeded(eventRecorder, stackInfo.stackName, {
 					created: deployResult.created,
 					updated: deployResult.updated,
-					deleted: deployResult.deleted
+					deleted: deployResult.deleted,
+					...deployResult.deleteSkipped > 0 && { skipped: deployResult.deleteSkipped }
 				}, deployResult.durationMs);
 			} catch (deployError) {
 				if (deployError instanceof DeployCancelledError) return;
@@ -77185,7 +77320,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.7");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.283.9");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;